Privacy policy

This policy explains how Infinity Consciousness Europe SIA (“we”), trading as Orbit Signal, processes personal data when you use this website, the workspace, or the client portal.

Controller: Infinity Consciousness Europe SIA, registration number 50203642241, VAT LV50203642241, Vēja iela 4 – 2, Ādaži, Ādažu novads, LV-2164, Latvia. Privacy contact: hello@orbitcue.app.

It is written for the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and Data Protection Act 2018, and the Latvian Personal Data Processing Law (Fizisko personu datu apstrādes likums).

• Account data: name, email, password hash, workspace role, and invitations.
• Project data you choose to publish: phase, milestone, date, action, and file names. Customer routes do not receive source rows, internal notes, or costs.
• Monday.com credentials, when you connect a live account: OAuth tokens encrypted with AES-256-GCM.
• Billing: Paddle collects the card, billing address, and tax identifiers. We store the Paddle transaction reference and the licence status, not the full card number.
• Technical logs: IP address, browser, and error traces needed to run and secure the service.
• Website statistics: cookieless counts of steps such as opening a demo, starting sign-up, and booking a call. Each count stores the event name, the page path, a short label, and the time. No IP address, cookie, or identifier is stored, and the browser’s Do Not Track or Global Privacy Control setting turns it off. Workspace milestones (first project, first published page, first shared link, first payment) are counted per workspace.

• Contract (Art. 6(1)(b)): to run the workspace, authenticate you, and publish the snapshot you approved.
• Legal obligation (Art. 6(1)(c)): accounting and tax records under Latvian law.
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, and keeping one tenant from reading another.
• Consent (Art. 6(1)(a)): only where we ask for an optional use. This site does not set advertising cookies.

International transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on Standard Contractual Clauses.

Account data stays while the workspace is open. Deleting the organization removes tenant records and scrubs audit metadata. A tombstone may remain so the deletion itself can be shown. Invoices and tax records are kept for at least five years under the Latvian Accounting Law (Likums “Par grāmatvedību”). Revoking a client ends that session and outstanding file links.

If you are in the EEA or the United Kingdom you can ask for access, correction, erasure, restriction, portability, or object to processing based on legitimate interests (GDPR Arts. 15–21). Write to hello@orbitcue.app. We answer verified requests within one month. An owner can export the workspace from the product.

If you publish a client’s data, you are the controller of that content and we are the processor. The data processing terms describe that role.

• Lead EU authority: Data State Inspectorate (DVI), Elijas iela 17, Rīga, LV-1050, Latvia. +371 67 22 31 31. pasts@dvi.gov.lv. dvi.gov.lv
• United Kingdom: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. +44 303 123 1113. casework@ico.org.uk. ico.org.uk